Lease obligations, long accounted for off balance sheet, are now being reflected on companies’ balance sheets. Companies currently adopting the new ASC 842 lease accounting standard from the Financial Accounting Standards Board (FASB) are keenly focused on getting the numbers right in their financial statements—so focused, in fact, that they could overlook the internal controls essential to complying with the new standard.

For example, because compliance with the new standard is so data-intensive, it’s critical to have controls over the data that are used to generate lease accounting entries and disclosures. However sophisticated the lease accounting technology or underlying spreadsheets may be, if there are no internal controls over the accuracy of the data, risks to the financial statements will likely be unmitigated.

ASC 842 also presents concepts that either didn’t exist under the legacy lease accounting standard (ASC 840) or may receive renewed focus because of their impact under the new standard. Examples include accounting for lease reassessments and discount rates, both of which involve significant management judgment. Greater reliance on management judgment increases inherent risk and thus requires additional scrutiny by enterprise leaders and auditors, ultimately creating the need for more robust internal controls. To address the inherent risk, qualified individuals need

to make those judgments. Similarly, capable people are needed to check their work. (See “The roles of the preparer and the reviewer.”)

Companies can benefit from adopting new internal controls or refining existing internal controls in four areas of ASC 842 planning and implementation:

Internal controls considerations for lease accountingFour areas of ASC 842 planning and implementation that warrant a close look

Spreadsheet design or technology deployment

Transition/implementation (preadoption and Day One)

Ongoing business processes (Day Two and beyond)

Entity-level controls

Effective January 1, 2019, the new FASB lease accounting standard, ASC 842, brought leases onto the balance sheets of public companies with a calendar fiscal year-end. Other public companies will become subject to the standard throughout 2019, and private companies will follow in 2021. For many of these companies, ASC 842 could have a significant impact on financial statements.

Internal controls considerations for lease accounting

2

The controls discussed may not be appropriate or comprehensive for many organizations. Each company should consider its unique inherent risks and design and implement internal controls meant to address those risks. The controls identified here are examples we believe may address risks commonly seen in lease accounting and implementation projects.

• Provide management and board oversight of implementation to confirm adequacy of planning, resources, and accountability.

• Update risk assessments to identify and respond to new risks, including fraud risk.

• Revise accounting policies and business process controls.

• Train and communicate with relevant stakeholders.

Entity-level controls aren’t likely to change because of the new lease standard. Company management and the audit committee should already provide executive oversight of all internal controls, processes, employee accountability, and stakeholder training and communication. As part of those responsibilities, they will likely want to understand the implementation road map for the lease standard and confirm that existing controls adequately encompass it as part of overall accounting oversight. Senior management should communicate the change throughout the organization, including to stakeholders outside the accounting function and outside the organization as necessary.

Consider the new lease standard when executing entity-level controls

For a new technology solution: • Prepare a robust set of business requirements that the technology solution needs to address

• Actively engage key stakeholders who understand the ASC 842 requirements in the vendor selection process

• Run sample scenarios through the lease technology and assess the output for completeness and accuracy of both journal entries and disclosures

• Confirm management’s understanding of internal controls reports, such as Service Organization Control-1 (SOC-1) and Service Organization Control-2 (SOC-2) reports, available from the lease technology vendor

For spreadsheet design and implementation: • Review and test the calculation logic and formulas of spreadsheets and related compliance to ASC 842

• Test the aggregation of individual lease information into journal entries and disclosures

Some companies have found they need to either implement new software or modify existing software to address the new requirements. Companies with smaller, less complex lease portfolios may address compliance with a spreadsheet-based solution. In general, companies with more than 100 leases may find it difficult to manage the portfolio with spreadsheets.

Determine whether new software applications are needed

Internal controls considerations for lease accounting

3

Identify a complete and accurate listing of leases: • Preparers—Gather all leases into a central repository and identify any contracts that are or may contain leases (i.e., embedded leases). Use surveys, departmental inquiries regarding embedded leases, and other procedures to identify a full lease population.

• Reviewers—Using knowledge of the new standard and the organization, assess whether the lease population is complete, including embedded leases.

Identify appropriate discount rates and other significant management assumptions: • Preparers—Identify significant assumptions and/or models used to generate discount rates. For example, if an incremental borrowing rate comprises a base reference rate, an adjustment for the company’s own credit risk, and the impact of collateral, document the significant assumptions and sources used to derive these elements of the discount rate.

• Reviewers—Review the overall logic used to determine discount rates and evaluate the significant assumptions and/or models used to generate such rates.

Consider other management judgments in an entity’s internal control environment, such as lease term or fair value of the underlying asset: • Preparers—Document the judgments and the assumptions utilized to make those judgments for matters that have an impact on the accounting for leases. For example, if a preparer determines renewal options are reasonably certain of exercise, document the factors that affected that conclusion.

• Reviewers—Evaluate whether the cash flow period is consistent with judgments around the lease term and whether the lease term applied is consistent with the facts stated by the preparer and with an appropriate application of GAAP.

Address complex accounting matters: • Preparers—Analyze contracts with complex terms. For example, for a sale and leaseback transaction accounted for as a financing under ASC 840, analyze the contract to determine whether an asset transfer is a sale and apply the principles of ASC 606 in accordance with ASC 842-40.

• Reviewers—Analyze and challenge the transition implications and conclusions documented by the preparer considering relevant contract terms and evaluate the impact under ASC 842.

Some controls are unique to the transition period. Because of this, reviewers need to be diligent in their reviews during the transition period. Otherwise, Day One errors can trigger errors in ongoing accounting.

Complete transition elections and document policies in accordance with GAAP: • Preparers—Document transition elections and policies agreed upon with management.

• Reviewers—Assess whether the documented transition elections, including the selection of any practical expedients, comply with US GAAP.

Gather lease data: • Preparers—Determine data needed to facilitate transition to a new or modified IT system or for calculations in a spreadsheet.

• Reviewers—Review data-gathering plan and determine whether it is complete.

• Preparers—Manually or systematically migrate data fields currently resident in existing systems or spreadsheets to the new system or spreadsheet. – Data fields not currently maintained in a system or spreadsheet will likely need to be populated using data from lease contracts or management judgments.

• Reviewers—Determine whether there are controls over the data to be migrated and, prior to migration, assess whether they’re designed and implemented appropriately and operating effectively. Review migrated data for accuracy, completeness, and proper data validation.

• Preparers—Abstract data from source documents or management judgments into the lease accounting solution manually or via system interface. If data abstraction is outsourced to a third party, establish procedures to test the results.

• Reviewers—Review contracts containing leases to determine that relevant information necessary for lease accounting is abstracted. Focus on completeness (trace data from the source document to technology solution) and accuracy (trace data from technology solution to source document).

Prepare for transition and standard implementation (preadoption and Day One)

Internal controls considerations for lease accounting

4

Anticipate the requirements to implement new activities: • New leases, modified leases, and lease reassessment

– Preparers— Determine whether new leases are entered into or modified during the period. For new leases, apply similar procedures to gather and enter appropriate data into the technology solution or spreadsheet. For modifications to existing leases, determine the appropriate accounting per the terms of the contracts and in accordance with ASC 842 and document conclusions.

– Reviewers—Review/approve new leases consistent with controls established for transition. Review and challenge conclusion in accounting memos for lease modifications and test key inputs.

– Lease reassessment is a new concept in lease accounting under ASC 842, and companies likely don’t have internal controls to monitor for reassessment events.

– Under ASC 842, companies must monitor for significant events or changes in circumstances within the lessee’s control that directly affect whether it is reasonably certain, or not certain, to exercise an option to extend or terminate the lease or to purchase the underlying asset. Companies may also need a control to identify whether any reassessment events or circumstances have occurred during the quarterly reporting period. A qualified reviewer can determine the appropriate accounting impact for the event or circumstance.

– Example: Companies should monitor whether the construction of leasehold improvements that are expected to have significant economic value for the lessee will affect the conclusion about whether a renewal option will be exercised.

• Continual monitoring of technology – Companies implementing third-party lease accounting technology should plan to request and evaluate SOC-1 and SOC-2 reports and assess whether user controls are also designed and implemented appropriately.

– If a spreadsheet or in-house system is used, appropriate controls over the system or spreadsheet should be implemented and tested.

• Ongoing data abstraction – Maintain data abstraction controls designed and implemented during the transition period for new and modified leases.

• Discount rates – While discount rates don’t need to be updated on leases not otherwise modified or reassessed, they need to be determined for new and modified leases. Companies should establish a repeatable process if new leases are negotiated regularly.

– Preparers—Determine whether new leases exist. Identify significant assumptions and/or models used to generate discount rates. For example, if an incremental borrowing rate comprises a base reference rate, an adjustment for the company’s own credit risk, and the impact of collateral, document the significant assumptions and sources used to derive these elements of the discount rate.

– Reviewers—Review the overall logic used to determine discount rates and evaluate the significant assumptions and/or models used to generate such rates.

• Disclosures – Under ASC 842, companies must monitor leasing activities to comply with the disclosure principle underlying the standard.

– Preparers—Review disclosure requirements for each reporting period and assess whether any leasing transactions would require separate qualitative or quantitative disclosure. In addition, compile any information needed to comply with the disclosure requirements (e.g., weighted-average remaining lease term) and ensure there are controls over any reports that generate such information.

– Reviewers—Evaluate the completeness and accuracy of those disclosures based on an appropriate understanding of the company’s leasing activities and the requirements in ASC 842 and elsewhere in GAAP.

Establish ongoing business processes (Day Two and forward)

Internal controls considerations for lease accounting

5

A steep path ahead for public and private companies

ASC 842 is likely to be one of the biggest accounting changes in recent history, and companies should have conversations with their auditors throughout their implementations. Going forward, for both public and private enterprises, having confidence in financial statement numbers likely depends more than ever on the development and use of appropriately designed and documented internal controls. In short, the right controls can be crucial to getting the new standard right.

The roles of the preparer and the reviewerSensitivity is growing, both in internal controls environments and among auditors, regarding the distinction between a process and a control. Making an accounting estimate or other judgment is a process. Within that process, internal controls are essential to address the risks that arise from that judgment.

Companies will want to evaluate whether the individuals assigned to perform the processes (preparers) and the internal controls stewards (reviewers) have the requisite skills and knowledge to create effective controls. Which people fill those roles likely depends on the company’s organizational structure and the expertise possessed and required for each process and internal control. The skills and backgrounds of the individuals in these roles can vary throughout the organization.

Let’s talk

For additional information regarding the above and other interpretative guidance related to the new lease standard, contact:

Jeanne McGovern Audit & Assurance Partner Deloitte & Touche LLP +1 201 761 3625 jmcgovern@deloitte.com

Lauren Pesa Audit & Assurance Senior Manager Deloitte & Touche LLP +1 312 486 4647 lpesa@deloitte.com

Sean TorrAdvisory Managing DirectorDeloitte & Touche LLP+1 615 479 1459storr@deloitte.com

This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor.

Deloitte shall not be responsible for any loss sustained by any person who relies on this publication.

About DeloitteDeloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the “Deloitte” name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/about to learn more about our global network of member firms.

Copyright © 2019 Deloitte Development LLC. All rights reserved

www.deloitte.com/us/audit